Hierarchical cooperated network virus and malice code recognition method

Abstract

A layered coordinate network virus and vicious code recognizing method. The characteristics are: use strong self-protection mechanism of biological immunity for reference, correspond the network virus and vicious code recognizing method to the multi-level protective mechanism of biological immunity system, judge the dangerous degree of the stand-by detected script through statistically analyzing the word frequency of the key words, based on the point view of 'self-collection' of register form operation analyze and judge the exceptional behavior of the register form written in the form route, and recognize non-self the executing sequence of the programming interface of the applied program, at last send all the exceptional behavior information to the network control station through the network. It well solves the problem of the identification of the unknown network virus and vicious code, and has good capacity of identification, realizes the monitoring and management of the network virus and vicious code of single system and the whole sub-network.

Description

Technical field: [0001] The invention belongs to the technical field of computer network security, in particular to the identification technology of network viruses and malicious codes. Background technique: [0002] According to the introduction of the Institute of Electrical and Electronics Engineers "Potential" magazine (IEEE POTENTIALS, October 2001, the fourth issue, pages 16-19) published in the United States, the existing computer anti-virus identification technologies can be roughly divided into the following types: ( 1) Scanning based on signatures, mainly for known viruses. (2) virtual machine technology, its basic idea is to place suspicious programs in a virtual machine environment to execute to determine whether it is a virus, but still faces many problems such as the effect of virtual machines and how to ensure the security of virtual machines. (3) The heuristic method, whose basic idea is to try to detect family viruses and unknown viruses through generalized...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the deficiencies of existing network virus and malicious code identification technologies, the present invention proposes a layered and collaborative network virus and malicious code identification method to solve the problem of identifying abnormal behaviors of unknown network viruses and malicious codes, and to realize the identification of a single system and the entire system. Monitoring of unknown network viruses and malicious code abnormal behavior in the subnet

Images